CVE-2026-72819: Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload
Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead of string notation, call the unZip routine with a malicious archive, and write PHP files to the web root for execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72819?
CVE-2026-72819 has a severity score of 8.8, classified as high.
How do I fix CVE-2026-72819?
To fix CVE-2026-72819, update Grav CMS to version 2.0.13 or later.
What type of vulnerability is CVE-2026-72819?
CVE-2026-72819 is a remote code execution vulnerability that allows code injection through ZIP file uploads.
Who is affected by CVE-2026-72819?
Grav CMS users running versions before 2.0.13 are affected by CVE-2026-72819.
What can attackers achieve with CVE-2026-72819?
Attackers can execute arbitrary code on the server by uploading a malicious ZIP file with PHP code.